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<tf* Tilc control requirements and procedures that are being 

Qaj^^ 

i #- developed for manned spacecraft iiffer in a number of important re- 
V - ^ spects from the conventional pra :ticcs that have evolved in previous 

aircraft and missile programs. Hiese differences are a natural con- 
sequence of some of the distinctive features of manned space flight 
pregpanss and v§hiele§. In my £ana?ks tonight I will attempt to 
y- point out a few of these distinctive features and their effect on 

^(/^reliability and quality control xiquirements . 

I /j 

The most outstanding feature of our programs is their research 
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character. Tlie flight missions being undertaken in the manned ex- 
ploration of space are in every ::ense of the word research flights . 
They are a search fox' knowledge, not only of space itself, but also 
on how to survive, travel, end nuneuver in space; to take off and 

i 

land spacecraft on the earth, the moon, and eventually the planets. 

The spacecraft we use are single -purpose devices, few in num- 
ber, tailored specifically to each particular mission. Once the 
mission for which they arc desigi ed has been accomplished, they are 
unlikely to enter a production pi ase or enjoy a long period of 
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operational use as might -a missile or airplane. In this sense* 
our quality control problems era much closer to those of the X-15 

than to those of Ihe B-58. 

For those few pioneering spacecraft we must obtain parts* com- 
ponents* subsystems, and engir.ee .ting as near to perfection as the 
nation’s finest craftsman can achieve. 

The single-purpose character of our spacecraft is not exactly 
of our ovm choosing. Nature has perversely laid out the stepping 
stones to space in such a way as to require a substantial advance 
in propulsion capability between each step. An urgent need for 
tangible evidence of progress in space impalls us to attempt each 
step as soon as the minimum capability can be achieved. Because 
we are undertaking successive missions as rapidly as possible, 
always at the extrams outer limit of our advancing propulsion capa- 
bility, the spacecraft we use art rightly weight limited. They can 
never be provided with the growth potential that would allow them 
to be adapted to succeeding stepi . Nor can the experienced engineer- 
Ing team completing the crucial i inal flight stages of one program 
be safely diverted from its task to undertake the design of the ve- 
hicle . Thus, we must progress b\ a series of more or less inde- 
pendent programs, cadi of increasing size and complexity, over- 
lapping in time, and manned by different independent teams of govern- 
ment and contractor engineers, each having little if any first-hand 
familiarity with the i^pst recent manned space flight experience 
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calls for strong emphasis or rap 1(1 dissemination of operational 
experience with spacecraft systems throughout the entire manage- 
ment, engineering, industrial, aid educational complex. No matter 
hoy liard we work on this approach, however, we cannot hope to achieve 
perfection. Some design decisions will still be made in ignorance 
of information that exists, and others will be shown wrong by infor- 
mation yet to be acquired. Thaso errors will have to be corrected 
before flight. Thus we arrive a : what is perhaps the most impor- 
tant single requirement in our programs; that designs, procedures . 
and schedules must have the flexibility to absorb a steady stream 
of chnrr-.-o reneratod by a con tin ir.lly increasing understanding of 
s-vee problems . Reliability, .tu tlity control, manufacturing, and 
procurement plans must all be sen up with full recognition of this 
requirement for continual hardware change. 

The flow of new information from current space programs is not 
the only source of requirements :'or change. Equipment malfunctions 
that occur during system develop! ent testing or preflight prepara- 
tions arc often of equal or greater importance. In manned flight 
we cannot afford to regard any o:' these equipment malfunctions as 
a random failure. We must regard every malfunction and, in fact, 
every observed peculiarity in the behavior of a system as an Impor- 
tant warning of potential disaster. Only when the cause is thorough- 
ly understood, and a change to eliminate it has been made, can we 
proceed with the flight program. 
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The problem here is one ox shortening the failure detection 

V 

corrective action cycle to el.int rate disastrous effects on operating 


schedules. We are finding it n t cessary todrequire very drastic 
streamlining of pw^iiwa 'n-^rr. tzeenzi ^ ^ stss s — 


ISslT wher-e action seldom s tarts until a failure has been re- 
peated at least enough times to accumulate a noticeable pile of 
IBM cards, and where the subsciqiant paper-lined path from prime 
contractor, to subcontractor, t c parts vendor, and back, too often 
produces little but delay, cost, and disclaimers of responsibility, 
Rryoid corrective response t o malfunctions throughout system 
envelopment and preflight prerar rtions is a critically important 
requirement, of our programs if v : are to meet schedules with hard- 
ware that is fit to fly. To the maximum extent possible, failure 
analysis and. decisions as to cor ^active action must take place im- 
mediately at the scene of the failure, where the availability of 
the part, the test set-up, and tie people involved in the test, 
offers the best opportunity for iccurate determination of the perti- 
nent facts. Contracts and purch ise agreements with component and 
parts suppliers should provide tiiat tlxe services of their engineer- 
ing staffs will be available on nail whenever required for this 
purpose. Constructive and effective reaction to the emergency situ- 
ation created when a failure requires redesign of a spacecraft com- 
ponent is the most welcome contr: fcution an individual or company 
can make to the nation's space piograms. 
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Another distinctive charac .-eristic of our spacecraft is the 
large number of one-shot and liiited-life items used in the various 
subsystems. TJiis characteristic limits the amount of proof testing 
that can be performed on the acxal flight articles. In the case 
of items such as the heat shield, escape rockets, explosive separa- 
ticn devices, explosive discount cts , igniters, etc., the actual 
specimen to be flown cannot be lasted at all. Items such as fuel 
cells, ablative nozzles, paracht tes , and launch vehicle engines 
can be given only limited tests, under conditions that are not 
truly representative, and then c nly at considerable risk that the 
tests and their aftermath may ir troduce more flight failures than 
they prevent. This particular j rob lem is of course shared by the 
ballistic missile but not by the airplane. 

The operating philosophy that has evolved to meet the situation 
is based on the idea that ranc.orrly selected samples of components 
can be subjected, in a so-called qualification test program, to 
appropriate environmental, relia jility, and overstress tests with 
complete confidence that the res ilts of these tests will apply to 
the remaining articles installed in -die flight vehicles. This 
confidence is not justified unlc :s all supposedly identical parts 
from which the components are as .cmbled are tioily identical in all 
essential features. Although the parts can be inspected and their 
primary characteristics can be measured, identity in the sense re- 
quired by the qualification test philosophy cannot be fully estab- 
lishad by inspection and measurer ent alone. Features that eventually 


turn out to be important in governing sensitivity to environment 
of susceptibility to failure of -en are unrecognised or inadequately 
defined by inspection or measur iraent at the tins" of-manufactiirc . 


To acliicve a degree of eon LtoI over whatever unknown or inde- 
terniindte Influences may exist, consideration must be given to the 
necessity that all components -r ynzirin g ce yrrl cation through a 


or r }, .‘fixation test program be n fe up from sets of -parts whose 
r ' cv- 3 have been pypdusad -vtMv the same H.ssgTnhiy line 


thout an Intervening change i ■ cl.es im , process, or materials . 
Handling subsequent to manufacture must also be identical and must 
be controlled to hold environmental stresses well within the limits 
to bo experienced by the part during the qualification tests. It 
is also necessary that the parts i be identified individually or as 
members of the set and that records show the location of all parts 
in a set. 


This requirement for ident: fication of parts is of critical 
importance whenever failure of < component under test reveals a 
defect in a part which can be a - ; tributed to the design or to the 
manufacturing or handling process. It then becomes essential to 
locate and remove imediately from all flight components all similar 
parts . Since these parts may he ve been used in more than the one 
type of component that revealed the deficiency, it is not sufficient 
merely to remove all of that tyja of component. The very strict 
control over parts identification and use that we are seeking is 
necessary to insure that all suspected parts, whenever used, can 
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be readily located for removal .aid replacement. 

In the area of inspection, flight safety considerations and 
the limited number of articles involved in our programs make it 
reasonable to require ICO per cent inspection of all items. In- 
spection procedures must be des: gned to locate and reject every 
defective or marginal part, no latter how many good parts are un- 
necessarily rejected in the process. We are not alone in this mat- 
ter of extreme selectivity in tl e acceptance of parts for space- 
craft. In the outstandingly successful Telestar satellite 53,800 
acceptable solid state devices v are examined to select the 22,500 
for the 7 fly able models. 

Another indication of what can be accomplished by selectivity 
combined with persistent attention to detail has been provided by 
the program devised by the Aiz* I once and the Aerospace Corporation 
for the selection and preparatic n of the Atlas boosters for manned 
Mercury flights. Recognizing id: at major design changes to increase . 
the reliability potential of the basic design could not be accom- 
plished within the life of the K zrcury program, they set ouir to make 
certain that the maximum reliebi Lity of which the design was capable 
would actually be achieved in. Mercury operations. The program that 
resulted involved three parts, a Component Selection Program, a 
Factory Rollout Inspection Progrzra, and s Flight Safety Review Pro- 
gram at the launch site. 

In "-the coma onen t, selection >rogram all availabl e - A t l as compon- 
ents were screened. Those whose prior history and performance under 



In the flight safety review program similar technical teams 
were organized at the launch sits to monitor and record the per- 
formance of cadi subsystem thror shout all pref light preparations 
and chedcout activities. These teams reported to a senior review 
hoard drnrged v.’ith the final res lonsibility for reviewing all the 
problems and actions pertinent t o tlie booster and certifying that* 
within die limits of human knowledge, it v.us ready for manned 
orbital flight. 

As a result of this program, the Mercury boosters have re- 
quired twice the normal man-heurj to fabricate, and have received 
more than three times the normal chedcout time and attention. While 
no r.m can say that thi3 formula insures success, it certainly does 
not invite failure. 

In the case of the spacecra it, we have followed a generally 
similar approach as regards tech ileal surveillance and review of 
subsystem performance. Special emphasis has been placed on main- 
taining a particularly high levc. . of technical capability at the 
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launch, site, and on very thorough investigations of every synipton 
of trouble during the rather extensive pre flight preparation. A 
basic ground rule of the operation has been that the spacecraft 
cannot be committed to flight while any observed difficulty renal ns 
unexplained or uncorrccted. 

vvo believe these operating procedures developed for the Mercury 
booster and spacecraft have beer very effective in concentrating 
the attention of the best crucial icd technical talent available on 
the detailed engineering problem 3 of each vehicle. Similar pro- 
cedures will be followed in ovr nature programs. 

In the design and testing ai'cas our approach to the relia- 
bilify and flight safety problem also reflects lessons learned in 
previous l'eseareh airplane , missile, and space flight programs. 

While we attempt to augment safe ry wherever practical by emergency 
escape provisions , we recognise rliat the most effective approach 
to safety is through vehicle reliability. 

To insure that adequate attention is directed to reliability 
in tlie design stage we specify ai overall numerical reliability 
goal, for the spacecraft. This o -crall goal is subsequently budgeted 
to the various subsystems by the spacecraft designer. These nusaer- 
ical* reliability requirements are very useful in the design stage 
because they give the subsystem designer a rational basis for de- 
ciding on the degree of redundancy, derating of parts, and other 
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reliability improvement measure: that should be incorporated in 
Iiis subsystem. 

In estimating the reliability of a proposed subsystem design, 
us a must be made of failure rate data or estimates for the indi- 
vidual parts that nuke up the sibsystera. These failure rate esti- 
mates normally include only the so-called random or statistical 
type of failure that predominate 3 in fully developed parts . Hence , 
subsystem and spacecraft reliubj lity values derived in tills way 
tend to reflect the minimum fail ura rate that may ultimately be 
obtained with the design* The z ctual subsystem failure rates may 
initially be much higher because of design errors, interaction ef- 
fects between parts and camp oner ts , unanticipated environmental 
effects, or errors in estimating environments. Virtually all of 
our flight difficulties to dale mve been in this subsystem • devel- 
opment category. Most would lavs been detected and eliminated be- 
fore flight if the ground test techniques and programs that were 
ultimately devised had been available at that time, /vs a result 
of. this experience, we ere tcndiig to concentrate much of our re- 
liability effort on devising sub lystera test programs that will detect 
and eliminate these avoidable so trees of failure before flight. 

Basically, our approach is an attempt to lay out system de- 

1 . 

signs that will absorb the expec red number of pants failures with- 
out scz’ious consequences, and to lay out a testing program that will 
assure detection ana 'correction < >f all other sources of system 
failure before flight • 


10 


- 11 - 


TI;s last and most fundaren :al requirement for success in our 
manned space effort is for the kind of people who will not permit 
it to fail. In the final analysts there are very few failures in 
the history of flight that could not have been avoided, if some- 
one, somewhere, had been more experienced, more skillful, more care 
ful, ox' more highly motivated, ''o design, build, and operate the 
vehicles that will pioneer the exploration of space requires the 
services of the most capable and most experienced people and com- 
panies of the Aerospace Industry people whose pride in their 
erafts.riansliip will permit no c am roird.se of the quality essential 
to success; people who will navt r overlook or ignore the slightest 
sign of trouble; people who will freely give that last bit of extra 
effort that so often spells tlx* tifference between success and 
folium,. 

The requirements for rellal ility and quality that I have been 
discussing this evening arc perto ps best summarized in the simple 
basic philosophy from wliidli they derive: that every manned space- 

craft that leaves this earth on the most ambitious and challenging 
adventure in human history shall represent the best that dedicated 
and inspired men con create. V’e cannot ask for more; we dare not 
settle for less. 
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